<?php declare(strict_types=1); require_once __DIR__ . '/core/bootstrap.php'; if (isset($_GET['action']) && $_GET['action'] === 'logout') { $_SESSION = []; if (ini_get("session.use_cookies")) { $p = session_get_cookie_params(); setcookie(session_name(), '', time() - 42000, $p["path"], $p["domain"], $p["secure"], $p["httponly"]); } session_destroy(); header('Location: login.php'); exit; } if (isset($_SESSION['auth_phase']) && $_SESSION['auth_phase'] >= 1) { header('Location: login2.php'); exit; } if ($_SERVER['REQUEST_METHOD'] === 'POST') { header('Content-Type: application/json'); $submitted_csrf = $_POST['_csrf'] ?? ''; if (!CSRF::validate($submitted_csrf)) { http_response_code(403); exit(json_encode(['success' => false, 'error' => 'Security token expired. Refresh the page.'])); } $pin = $_POST['pin'] ?? ''; $result = AuthChain::validatePIN($pin); if ($result['success']) { $_SESSION['phase1_ip'] = $_SERVER['REMOTE_ADDR']; exit(json_encode(['success' => true, '_csrf' => $result['_csrf']])); } else { exit(json_encode(['success' => false, 'error' => $result['error']])); } } $csrf = CSRF::token(); ?> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="csrf-token" content="<?= htmlspecialchars($csrf) ?>"> <title>Secure Access</title> <style> *{margin:0;padding:0;box-sizing:border-box} body{min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0e1a;font-family:'Inter','Segoe UI',system-ui,sans-serif;color:#c8ccd4;overflow:hidden} body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellipse at 50% 0%,rgba(30,60,114,.3),transparent 70%);pointer-events:none} .auth-card{background:rgba(16,20,34,.92);border:1px solid rgba(255,255,255,.06);border-radius:16px;padding:36px 32px 28px;width:360px;text-align:center;backdrop-filter:blur(20px);box-shadow:0 8px 40px rgba(0,0,0,.5)} h1{font-size:22px;font-weight:700;color:#e2e6ed;margin-bottom:6px;letter-spacing:.5px} .phase-dots{display:flex;gap:8px;justify-content:center;margin-bottom:18px} .phase-dot{width:10px;height:10px;border-radius:50%;background:rgba(255,255,255,.15)} .phase-dot.current{background:#e6a817} .phase-dot.complete{background:#22c55e} .subtitle{font-size:13px;color:rgba(200,204,212,.5);margin-bottom:14px} #error{color:#ef4444;font-size:13px;min-height:20px;margin-bottom:4px} .pin-dots{display:flex;gap:8px;justify-content:center;margin-bottom:18px} .pin-dot{width:14px;height:14px;border-radius:50%;border:2px solid rgba(255,255,255,.2);transition:all .2s} .pin-dot.filled{background:#e6a817;border-color:#e6a817} .auth-grid{display:grid;grid-template-columns:repeat(3,1fr);gap:8px;margin-bottom:16px} .k-btn{background:rgba(255,255,255,.04);border:1px solid rgba(255,255,255,.08);border-radius:10px;color:#e2e6ed;font-size:20px;font-weight:600;padding:16px;cursor:pointer;transition:all .15s;user-select:none;-webkit-user-select:none;-webkit-tap-highlight-color:transparent} .k-btn:hover{background:rgba(255,255,255,.08);border-color:rgba(255,255,255,.15)} .k-btn:active{transform:scale(.95);background:rgba(255,255,255,.12)} .k-act{font-size:13px;font-weight:600;letter-spacing:1px;padding:14px;border-radius:10px;cursor:pointer;border:none;transition:all .15s;user-select:none} .k-clr{background:rgba(239,68,68,.12);color:#ef4444} .k-clr:hover:not(:disabled){background:rgba(239,68,68,.25)} .k-ent{background:rgba(34,197,94,.12);color:#22c55e} .k-ent:hover:not(:disabled){background:rgba(34,197,94,.25)} .k-act:disabled{opacity:.3;cursor:not-allowed} @keyframes shake{0%,100%{transform:translateX(0)}20%,60%{transform:translateX(-6px)}40%,80%{transform:translateX(6px)}} .shake{animation:shake .4s ease} </style> </head> <body> <div class="auth-card" id="auth-card"> <h1>Secure Access</h1> <div class="phase-dots"><span class="phase-dot current"></span><span class="phase-dot"></span><span class="phase-dot"></span></div> <div id="error"></div> <p class="subtitle">Enter 6-digit access code</p> <div class="pin-dots" id="pin-dots"></div> <div class="auth-grid" id="grid"></div> </div> <script src="/assets/js/inline/login.js"></script> </body> </html> 